@aventara/next 1.0.0-rc.10 → 1.0.0-rc.9

package/CHANGELOG.md

@@ -1,54 +1,5 @@
 # @aventara/next
 
-## 1.0.0-rc.10
-
-### Patch Changes
-
-- 04bb39a: `engines.node` is now `^22.23.4 || >=24.22.1`, the Node security releases of 2026-10-20 (CVE-2026-105481,
-  CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074,
-  CVE-2026-111497). The bins refuse an older Node in one sentence naming that range.
-- 587dd01: The route handlers answer `POST {api}/_access/can` when the Framework is built with `access`, through
-  `AvProtocol.bind(framework).handleCan`, with the request's state seeded as on every other protocol route.
-- d7e7369: `avClient.$access`: `framework.serverClient.$access` with the request filled in. `can` is answered under the
-  request's state; `me()` and the other Aventara Access verbs run in process with the headers of `next/headers` (a
-  Server Action's sign-in sets its cookie through Access itself). `ready()` registers the verbs for
-  `@/aventara/universal` on the server.
-- 7ee547b: `avClient.$access` carries Aventara Access's `kiosk` verbs (`switchUser`, `lock`, `setPin`, `enrollDevice`,
-  `revokeDevice`) when the provider states them, run in process with the headers of `next/headers`, so a Server Action's
-  switch sets the rotated device cookie through Access itself; `ready()` registers them for `@/aventara/universal`.
-- 88263a1: Documentation: `$access.can([])` answers `[]`, not a refusal; the MCP README states the query and fragment rule for
-  every authorization server.
-- 15f3402: `avClient.$access` holds only the verbs the access provider offers, as `serverClient.$access` does. Calling another one
-  rejects with `AvProtocolError` `A2002`, naming why (no `access`, or a provider that does not offer that verb), instead
-  of a `TypeError`.
-
-  In `next dev`, an edit that changes only a function (a guard's or a pipe's body, the adapter factory) builds the
-  Framework again; it no longer needs a restart.
-
-- Updated dependencies [587dd01]
-- Updated dependencies [d7e7369]
-- Updated dependencies [7ee547b]
-- Updated dependencies [f52c499]
-- Updated dependencies [2907484]
-- Updated dependencies [a6bbdf0]
-- Updated dependencies [3e26549]
-- Updated dependencies [a6bbdf0]
-- Updated dependencies [6f3f6f6]
-- Updated dependencies [04bb39a]
-- Updated dependencies [d7e7369]
-- Updated dependencies [3fb3333]
-- Updated dependencies [827ccb6]
-- Updated dependencies [7f5abc3]
-- Updated dependencies [88263a1]
-- Updated dependencies [10341d5]
-- Updated dependencies [8129844]
-- Updated dependencies [88263a1]
-- Updated dependencies [3020b5c]
-- Updated dependencies [88263a1]
-- Updated dependencies [88263a1]
-  - @aventara/core@1.0.0-rc.10
-  - @aventara/mcp@1.0.0-rc.10
-
 ## 1.0.0-rc.9
 
 ### Patch Changes

package/README.md

@@ -122,21 +122,6 @@ needs, one of:
 With none of them, `next build` fails with Next's own message, which names the three. In a request, inside
 `"use cache"`, in a Server Action, in an `after()` callback and without Cache Components the call runs at once.
 
-With `access`, `avClient.$access` is `framework.serverClient.$access` with this request filled in: `can([...])` is
-answered under the request's state, and `me()`, `signIn(...)` and the other verbs the provider offers run Aventara
-Access in process with the headers of `next/headers`. In a Server Action, Access sets a sign-in's cookie itself
-(Better Auth's `nextCookies`). `@/aventara/universal`'s `$access` does the same on the server, through what `ready()`
-registers, and calls Access's own routes in the browser. `$access` holds the verbs the provider offers, read from the
-options before the Framework is built, as `serverClient.$access` holds them. Calling another one rejects with
-`AvProtocolError` `A2002`, naming why: no `access`, or a provider whose `client` does not offer that verb.
-
-On Access's `kiosk` profile, call `switchUser`, `lock` and `enrollDevice` from a Server Action (or from the browser),
-never while rendering a Server Component: each rotates the device's credential cookie, which Next lets Access set only
-in a Server Action or a Route Handler, so a rotation during a render is lost and the device's next switch is refused. Never call a verb that
-changes anything (`signIn`, `signUp`, `signOut`, `resetPassword`, and the kiosk's five) inside `"use cache"`: a cached
-result would replay one caller's answer to another and skip the call. Each verb's answer is projected onto its result
-schema on the server too, so no session token or device secret reaches your code.
-
 `avApp` is `framework.application`: trusted server code. It reads no request, and the policy checks a call only when
 it names a principal (`{ as: principal }`).
 
@@ -182,10 +167,7 @@ for the routes and pages). Every copy that calls `Aventara()` with the same opti
 `api` path for the process, so `ready()` in `instrumentation.ts` builds the one the routes use, with one adapter, and
 `avClient.tx` works from the first request. Two instances on two `api` paths hold two. In production, a different
 configuration on a path already held is refused when `Aventara()` is called; in development it replaces the held one,
-as `next dev` evaluates the file again after an edit. Copies are told apart by the options' data (Next.js rewrites a
-function's source in each layer). An edit that changes only a function, a guard's or a pipe's body or the adapter
-factory, is told by each layer from the text that layer saw last: in development the first layer to see it builds the
-Framework again, and the other layers join that build. A Framework given as `{ framework }` is that call's own.
+as `next dev` evaluates the file again after an edit. A Framework given as `{ framework }` is that call's own.
 
 Once the Framework is built, `ready()` also registers the path `@/aventara/universal`'s `avClient` takes on the server
 (below). Without `instrumentation.ts`, that `avClient` refuses its calls on the server in one sentence.

package/dist/aventara.factory.js

@@ -10,7 +10,7 @@ export function Aventara(options) {
     const checked = checkedOptions(options);
     const { source } = checked;
     const slot = source.kind === "config"
-        ? frameworkSlot(String(options.api), optionsFingerprint(options), optionsFingerprint(options, "source"))
+        ? frameworkSlot(String(options.api), optionsFingerprint(options))
         : { fingerprint: "", framework: undefined, built: undefined };
     const held = (created) => {
         refuseMemberClashes(created);
@@ -46,14 +46,14 @@ export function Aventara(options) {
     const universalState = checked.state === undefined
         ? undefined
         : async () => (await requestState()) ?? {};
-    const { avClient, avApp } = createServerOperations({ built: frameworkOf, current: () => slot.built }, requestState, checked.access);
+    const { avClient, avApp } = createServerOperations({ built: frameworkOf, current: () => slot.built }, requestState);
     return {
         handlers: createRouteHandlers(protocolOf, checked.state),
         avClient,
         avApp,
         ready: () => {
             readied ??= protocolOf().then(() => {
-                registerUniversalPath(universalPath(protocolOf, universalState), avClient.$access);
+                registerUniversalPath(universalPath(protocolOf, universalState));
             });
             return readied;
         },

package/dist/host-bootstrap.validator.d.ts

@@ -1,4 +1,4 @@
-import type { AvAccessProvider, AvConfigAny, AvFramework } from "@aventara/core";
+import type { AvConfigAny, AvFramework } from "@aventara/core";
 import type { HostState } from "./route-handlers.factory.js";
 /**
  * Refuses an MCP endpoint without `authorization`: on Next.js it could answer
@@ -8,7 +8,7 @@ export declare function refuseOpenMcp(endpoint: {
     readonly authorization?: unknown;
 }): void;
 /** The options, split into what the host keeps and where its Framework comes from. */
-type CheckedOptions = {
+export type CheckedOptions = {
     /**
      * What seeds each request's state: the developer's `state`, or the
      * Framework's access provider's (`access`). Core never sees it.
@@ -16,19 +16,9 @@ type CheckedOptions = {
     readonly state: HostState | undefined;
     /** The Framework's source: one built elsewhere, or a configuration this host builds. */
     readonly source: FrameworkSourceOption;
-    /**
-     * The Framework's access provider's `client`, known before the Framework
-     * is built (`null` for a provider without one), or `undefined` with no
-     * `access`: which verbs `avClient.$access` holds.
-     */
-    readonly access: AccessClient | undefined;
-};
-/** What `avClient.$access` reads of an access provider: its `client`, or `null`. */
-export type AccessClient = {
-    readonly client: AvAccessProvider["client"] | null;
 };
 /** `{ framework }`: a Framework `createFramework` built; or a configuration for it. */
-type FrameworkSourceOption = {
+export type FrameworkSourceOption = {
     readonly kind: "framework";
     readonly framework: AvFramework;
 } | {
@@ -46,4 +36,3 @@ type FrameworkSourceOption = {
  * of an adapter.
  */
 export declare function checkedOptions(options: unknown): CheckedOptions;
-export {};

package/dist/host-bootstrap.validator.js

@@ -1,4 +1,4 @@
-import { accessProviderOf } from "@aventara/core/internal";
+import { accessStateOf } from "@aventara/core/internal";
 const NOT_AN_OBJECT = "Aventara: the options are not an object; pass `{ ...aventaraConfig, adapter, state }`, or `{ framework, state }`.";
 const NOT_A_FRAMEWORK = "Aventara: `framework` is not an Aventara Framework (it has no string `api` and no `contracts.client`); pass what `createFramework` resolved to.";
 function bothForms(keys) {
@@ -34,13 +34,9 @@ export function checkedOptions(options) {
         if (!isFramework(framework)) {
             throw new Error(NOT_A_FRAMEWORK);
         }
-        const provider = accessProviderOf(framework);
         return {
-            state: oneStateSeed(boundState, provider?.state),
+            state: oneStateSeed(boundState, accessStateOf(framework)),
             source: { kind: "framework", framework },
-            access: provider === undefined
-                ? undefined
-                : { client: provider.client ?? null },
         };
     }
     const access = config.access;
@@ -53,7 +49,6 @@ export function checkedOptions(options) {
                 ? { ...config, adapter: await adapter() }
                 : config,
         },
-        access: access === undefined ? undefined : { client: access.client ?? null },
     };
 }
 function oneStateSeed(state, access) {

package/dist/protocol-route.table.d.ts

@@ -2,13 +2,13 @@ import type { AvState } from "@aventara/core";
 import type { AvProtocolBinding, AvProtocolRequest, AvProtocolResponse } from "@aventara/core/protocol";
 import type { McpBinding, McpRequest, McpRoute } from "./mcp-binding.loader.js";
 /** One route `protocol.surface()` lists. */
-type SurfaceRoute = ReturnType<AvProtocolBinding["surface"]>[number];
+export type SurfaceRoute = ReturnType<AvProtocolBinding["surface"]>[number];
 /** The developer's `state` option over one route request: seeds its `ctx.$state`. */
 export type StateSeed = () => AvState | Promise<AvState>;
 /** What a route answers its request with: a bound protocol member. */
 export type RouteAnswer = (request: AvProtocolRequest, state: StateSeed | undefined) => AvProtocolResponse | Promise<AvProtocolResponse>;
 /** The bound member each kind of surface route is answered by. */
-type ProtocolRouteTable = {
+export type ProtocolRouteTable = {
     readonly [K in SurfaceRoute["kind"]]: (binding: AvProtocolBinding) => RouteAnswer;
 };
 export declare const PROTOCOL_ROUTES: ProtocolRouteTable;
@@ -18,4 +18,3 @@ export type McpRouteAnswer = (request: McpRequest, state: StateSeed | undefined)
 export declare const MCP_ROUTES: {
     readonly [K in McpRoute["kind"]]: (binding: McpBinding) => McpRouteAnswer;
 };
-export {};

package/dist/protocol-route.table.js

@@ -2,7 +2,6 @@ export const PROTOCOL_ROUTES = {
     operation: (binding) => (request, state) => binding.handleOperation(request, state === undefined ? {} : { state }),
     contract: (binding) => (request) => binding.encodeContract(request),
     transactions: (binding) => (request, state) => binding.handleTransaction(request, state === undefined ? {} : { state }),
-    can: (binding) => (request, state) => binding.handleCan(request, state === undefined ? {} : { state }),
 };
 export const MCP_ROUTES = {
     endpoint: (binding) => (request, state) => binding.handleEndpoint(request, state === undefined ? {} : { state }),

package/dist/request-body.reader.d.ts

@@ -3,7 +3,7 @@ import type { AvProtocolBinding, AvProtocolResponse } from "@aventara/core/proto
  * What the body reader hands on: the stored bytes, an unsupported coding, or a
  * body that does not decode in the coding it names.
  */
-type RequestBodyRead = {
+export type RequestBodyRead = {
     readonly kind: "read";
     readonly content: Uint8Array;
 } | {
@@ -32,4 +32,3 @@ export declare function readRawBody(request: Request, cap: number): Promise<{
     readonly kind: "read";
     readonly content: Uint8Array;
 }>;
-export {};

package/dist/server-operations.factory.d.ts

@@ -1,5 +1,4 @@
 import { type AvExecutionOptions, type AvFramework, type AvOperation, type AvState, type AvTransactionResults } from "@aventara/core";
-import type { AccessClient } from "./host-bootstrap.validator.js";
 /**
  * `avClient.transaction`: runs `avClient.tx` handles as one transaction, with
  * this request's state. Client-layer handles only: an `avApp.appTx` handle in
@@ -13,7 +12,7 @@ export type AvNextClientTransaction = <const Ops extends readonly AvOperation<un
  */
 export type AvNextAppTransaction = <const Ops extends readonly AvOperation<unknown, "application">[]>(operations: Ops, options?: AvExecutionOptions) => Promise<AvTransactionResults<Ops>>;
 /** Where the members find their Framework: built on first use, once. */
-type FrameworkSource = {
+export type FrameworkSource = {
     /** The Framework, built on the first call; a construction error is kept. */
     readonly built: () => Promise<AvFramework>;
     /** The Framework when it is already built, else `undefined`. */
@@ -33,8 +32,7 @@ export declare function refuseMemberClashes(framework: AvFramework): void;
  * request's state from `requestState` (a `state` the call names wins),
  * `avApp`'s as given.
  */
-export declare function createServerOperations(source: FrameworkSource, requestState: () => Promise<AvState | undefined>, access: AccessClient | undefined): {
+export declare function createServerOperations(source: FrameworkSource, requestState: () => Promise<AvState | undefined>): {
     readonly avClient: object;
     readonly avApp: object;
 };
-export {};

package/dist/server-operations.factory.js

@@ -1,7 +1,5 @@
-import { AvConstructionError, AvProtocolError, } from "@aventara/core";
-import { ACCESS_VERB_NAMES, ACCESS_VERBS, providerVerb, } from "@aventara/core/internal";
+import { AvConstructionError, } from "@aventara/core";
 import { io } from "next/cache.js";
-import { headers } from "next/headers.js";
 function ioBeforeCall() {
     try {
         return io();
@@ -11,7 +9,7 @@ function ioBeforeCall() {
     }
 }
 const handlesBeforeBuild = (member) => `Aventara: \`${member}\` builds its handles on the Framework, which is built on first use; \`await ready()\` before building them.`;
-const CLIENT_MEMBERS = ["tx", "transaction", "$access"];
+const CLIENT_MEMBERS = ["tx", "transaction"];
 const APPLICATION_MEMBERS = ["appTx", "transaction"];
 export function refuseMemberClashes(framework) {
     const clashes = [
@@ -31,7 +29,7 @@ function clashesOf(tree, resources, members) {
         .filter((member) => Object.hasOwn(resources, member))
         .map((member) => ({ tree, member }));
 }
-export function createServerOperations(source, requestState, access) {
+export function createServerOperations(source, requestState) {
     const withRequestState = async (options) => {
         if (options?.state !== undefined) {
             return options;
@@ -42,12 +40,10 @@ export function createServerOperations(source, requestState, access) {
     const asGiven = async (options) => options;
     const clientTransaction = transactionOf(source, withRequestState);
     const applicationTransaction = transactionOf(source, asGiven);
-    const verbs = accessOf(source, withRequestState, access);
     return {
         avClient: operationTree("avClient", source, (framework) => framework.serverClient, withRequestState, {
             tx: () => builders(source, "avClient.tx").serverClientTx,
             transaction: () => clientTransaction,
-            $access: () => verbs,
         }),
         avApp: operationTree("avApp", source, (framework) => framework.application, asGiven, {
             appTx: () => builders(source, "avApp.appTx").appTx,
@@ -55,61 +51,6 @@ export function createServerOperations(source, requestState, access) {
         }),
     };
 }
-const ACCESS_VERB_OPTIONS = [
-    ["can", 1],
-    ...ACCESS_VERB_NAMES.map((name) => [name, ACCESS_VERBS[name].args ? 1 : 0]),
-];
-function servedVerbs(access) {
-    if (access === undefined) {
-        return new Set();
-    }
-    const verbs = access.client?.verbs ?? {};
-    return new Set([
-        "can",
-        ...ACCESS_VERB_NAMES.filter((name) => providerVerb(verbs, name) !== undefined),
-    ]);
-}
-function unservedVerb(name, access) {
-    const why = access === undefined
-        ? `avClient.$access.${name}: this Framework has no \`access\`, so avClient has no $access.`
-        : `avClient.$access.${name}: the access provider offers no \`${name}\` (its \`client\` states no such verb).`;
-    return async () => {
-        throw new AvProtocolError("A2002", why);
-    };
-}
-function accessOf(source, fill, access) {
-    const served = servedVerbs(access);
-    const verbs = {};
-    const unserved = new Map();
-    for (const [name, at] of ACCESS_VERB_OPTIONS) {
-        if (!served.has(name)) {
-            unserved.set(name, unservedVerb(name, access));
-            continue;
-        }
-        verbs[name] = async (...args) => {
-            await ioBeforeCall();
-            const framework = await source.built();
-            const call = framework.serverClient.$access?.[name];
-            if (call === undefined) {
-                return unservedVerb(name, access)();
-            }
-            const given = args[at];
-            const called = args.slice(0, at);
-            called[at] =
-                name === "can"
-                    ? await fill(given)
-                    : given?.headers !== undefined
-                        ? given
-                        : { ...given, headers: await headers() };
-            return call(...called);
-        };
-    }
-    return new Proxy(Object.freeze(verbs), {
-        get: (target, key, receiver) => typeof key === "string" && unserved.has(key)
-            ? unserved.get(key)
-            : Reflect.get(target, key, receiver),
-    });
-}
 function builders(source, member) {
     const framework = source.current();
     if (framework === undefined) {

package/dist/shared-framework.registry.d.ts

@@ -7,6 +7,8 @@ export type FrameworkSlot = {
     /** The Framework once built. */
     built: AvFramework | undefined;
 };
+/** The `globalThis` key the build for `api` is held under. */
+export declare const frameworkKey: (api: string) => symbol;
 /**
  * The slot for `api` in this process: the one a copy of the same module
  * already holds (the same `fingerprint`), else a new one. A different
@@ -14,12 +16,10 @@ export type FrameworkSlot = {
  *
  * @throws Error when another configuration holds `api` in production.
  */
-export declare function frameworkSlot(api: string, fingerprint: string, source: string): FrameworkSlot;
+export declare function frameworkSlot(api: string, fingerprint: string): FrameworkSlot;
 /**
  * The options' fingerprint: their plain data in a stable order; a function or
  * any other object than plain data and arrays counts only as present, since
- * bundlers spell them differently in each layer of one app. With `functions`
- * `"source"`, a function counts by its source text instead: what one layer
- * compares with its own last call.
+ * bundlers spell them differently in each layer of one app.
  */
-export declare function optionsFingerprint(options: unknown, functions?: "presence" | "source"): string;
+export declare function optionsFingerprint(options: unknown): string;

package/dist/shared-framework.registry.js

@@ -1,25 +1,18 @@
 const KEY_PREFIX = "aventara.next.framework:";
 const environment = () => globalThis.process?.env;
-const lastCalls = new Map();
-const frameworkKey = (api) => Symbol.for(`${KEY_PREFIX}${api}`);
+export const frameworkKey = (api) => Symbol.for(`${KEY_PREFIX}${api}`);
 function claimed(api) {
     return `Aventara: another configuration already serves the \`api\` path ${api === "" ? "/" : api} in this process; give each Aventara() its own \`api\` path.`;
 }
-export function frameworkSlot(api, fingerprint, source) {
+export function frameworkSlot(api, fingerprint) {
     const key = frameworkKey(api);
     const global = globalThis;
     const held = global[key];
-    const production = environment()?.NODE_ENV === "production";
-    const last = lastCalls.get(api);
     if (held !== undefined) {
         if (held.fingerprint === fingerprint) {
-            const edited = !production && last?.slot === held && last.source !== source;
-            if (!edited) {
-                lastCalls.set(api, { source, slot: held });
-                return held;
-            }
+            return held;
         }
-        else if (production) {
+        if (environment()?.NODE_ENV === "production") {
             throw new Error(claimed(api));
         }
     }
@@ -29,17 +22,14 @@ export function frameworkSlot(api, fingerprint, source) {
         built: undefined,
     };
     global[key] = slot;
-    lastCalls.set(api, { source, slot });
     return slot;
 }
-export function optionsFingerprint(options, functions = "presence") {
+export function optionsFingerprint(options) {
     const seen = new Set();
     const walk = (value) => {
         switch (typeof value) {
             case "function":
-                return functions === "source"
-                    ? `fn${JSON.stringify(Function.prototype.toString.call(value))}`
-                    : "fn";
+                return "fn";
             case "bigint":
                 return `${value}n`;
             case "object":

package/dist/universal-path.registry.d.ts

@@ -21,8 +21,5 @@ export type UniversalPath = (url: string, init: UniversalRequest) => Promise<Uni
  * or by the protocol's absence answer.
  */
 export declare function universalPath(host: () => Promise<ProtocolHost>, state: StateSeed | undefined): UniversalPath;
-/**
- * Registers `path` as this server's in-process path for `@/aventara/universal`,
- * and `access`, `avClient.$access`, as its `$access` verbs on the server.
- */
-export declare function registerUniversalPath(path: UniversalPath, access?: object): void;
+/** Registers `path` as this server's in-process path for `@/aventara/universal`. */
+export declare function registerUniversalPath(path: UniversalPath): void;

package/dist/universal-path.registry.js

@@ -26,11 +26,6 @@ export function universalPath(host, state) {
         return { status: response.status, text: async () => response.body };
     };
 }
-const UNIVERSAL_ACCESS_KEY = Symbol.for("aventara.next.universal.access");
-export function registerUniversalPath(path, access) {
-    const holder = globalThis;
-    holder[UNIVERSAL_PATH_KEY] = path;
-    if (access !== undefined) {
-        holder[UNIVERSAL_ACCESS_KEY] = access;
-    }
+export function registerUniversalPath(path) {
+    globalThis[UNIVERSAL_PATH_KEY] = path;
 }

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@aventara/next",
-  "version": "1.0.0-rc.10",
+  "version": "1.0.0-rc.9",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Next.js App Router host integration for Aventara.",
   "type": "module",
   "engines": {
-    "node": "^22.23.4 || >=24.22.1"
+    "node": "^22.18.0 || >=24.2.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -22,11 +22,11 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@aventara/core": "1.0.0-rc.10",
+    "@aventara/core": "1.0.0-rc.9",
     "server-only": "0.0.1"
   },
   "peerDependencies": {
-    "@aventara/mcp": "1.0.0-rc.10",
+    "@aventara/mcp": "1.0.0-rc.9",
     "next": ">=16.4 <17",
     "react": "^19.0.0"
   },
@@ -53,11 +53,11 @@
     "access": "public"
   },
   "devDependencies": {
-    "@aventara/build": "1.0.0-rc.10",
-    "@aventara/client": "1.0.0-rc.10",
-    "@aventara/mcp": "1.0.0-rc.10",
-    "@aventara/testing": "1.0.0-rc.10",
-    "@modelcontextprotocol/sdk": "1.32.2",
+    "@aventara/build": "1.0.0-rc.9",
+    "@aventara/client": "1.0.0-rc.9",
+    "@aventara/mcp": "1.0.0-rc.9",
+    "@aventara/testing": "1.0.0-rc.9",
+    "@modelcontextprotocol/sdk": "1.30.1",
     "@tanstack/react-query": "5.104.2",
     "@types/react": "19.3.0",
     "jsdom": "30.1.2",